IPSEC: ensure that mbufs are mapped if ipsec is enabled

[kib]

Summary

Ipsec needs access to packet headers to determine if a policy is
applicable. It seems that typically IP headers are mapped, but the code
is arguably needs to check this before blindly accessing them. Then,
operations like m_unshare() and m_makespace() are not yet ready for
unmapped mbufs.

Ensure that the packet is mapped before calling into IPSEC_OUTPUT().

PR:     272616

[markj]

sys/netinet6/ip6_output.c

814

BTW, don't we need to reload ip6 after calling IPSEC_OUTPUT here?

[kib]

sys/netinet6/ip6_output.c

814

I do not think so, same as for ipv4 case. Either ipsec_output() consumed mbuf chain and would insert a different one into ip{4,6}_output already or sometime in future, or the chain is kept as is. It is not the case that ipsec tinker with the mbuf and return it back.

[jhb]

Are there other existing mb_unmapped_to_ext calls that can now be removed after this? I feel like we added some in IPSec previously.

Oh, those were for checksumming and were removed after Mark fixed checksumming to work on unmapped.